VPN Pass Through
It’s possible to have the WLC configured as an VPN Pass Through server.
Unfortunally you need a VPN Module to have this working. (And I don’t have it)
The configuration and working is very easy :
Select as Layer 3 security : VPN Pass Through.
The VPN Gateway Address is the ip address of the VPN terminating device.
On the client you can configure the VPN Client and point it to ip address of the WLC, but with the credentials of the VPN Terminating device.
An example configuration can be found at : http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807e0b6a.shtml
I don’t think you’ll have to know the config of the VPN Terminating Device for the lab.